CVE-2026-46346

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46346
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46346.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46346
Aliases
  • GHSA-gj5g-4rxf-8rmq
Published
2026-10-23T14:14:39Z
Modified
2026-10-28T11:01:09Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
Details

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-330",
        "CWE-340",
        "CWE-640"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46346.json"
}
References

Affected packages

Git / github.com/intranda/goobi-viewer-core

Affected ranges

Type
GIT
Repo
https://github.com/intranda/goobi-viewer-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7e5e9de18c572c7b96f80efe01254bf08dc4cdb4
Fixed
9c2c83f00f497c11ab6aaa0bd5a68173cd446eef
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "26.05"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "9c2c83f00f497c11ab6aaa0bd5a68173cd446eef"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v26.05",
            "range": [
                {
                    "fixed": "7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v24.*
v24.12
v25.*
v25.01
v25.02
v25.04
v25.05
v25.05.1
v25.05.2
v25.06
v25.06.1
v25.06.2
v25.06.3
v25.06.4
v25.08
v25.08.1
v25.09
v25.09.1
v25.09.2
v25.09.3
v25.09.4
v25.09.5
v25.10
v25.10.1
v25.10.2
v25.10.3
v25.10.4
v25.10.6
v25.10.7
v25.10.8
v26.*
v26.01
v26.01.1
v26.02
v26.02.1
v26.02.2
v26.02.3
v26.02.4
v26.03
v26.03.1
v26.03.2
v26.03.3
v26.03.4
v26.03.5
v26.03.6
v26.03.7
v26.03.8
v26.04
v26.04.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46346.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "15972731808254145666261176205669785459",
            "length": 2933
        },
        "id": "CVE-2026-46346-2ad86a12",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
        "target": {
            "file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java",
            "function": "getAdvancedSearchSelectItems"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "293943419837386175782308880630292377328",
                "170127000326944715759514306120173437552",
                "223072314872435556758862870822129730388",
                "184713866145576581573500654664532882358",
                "237588089203428832734919670992173305409",
                "280990611135733430789396002312530922372",
                "24011410402069477058498461939093920262",
                "243679154761233145932008628234109855606",
                "21245126937807009457669850870559185657",
                "157573805690410280521963065924689943951",
                "49299172231513956195727309028396980246",
                "249794867519244567083176728280977870199",
                "71331133885813258577251813447387200972",
                "231280190624403314206933099108260677099",
                "131064644070503162456003862872168843296",
                "228717970448403275474455688186333628072",
                "147229437546344567055115541779032048353",
                "296771280783092075493187168226162854698",
                "120686590177198208650842153671343843197",
                "185110271319730517681325665849978046676",
                "133072927174758095098837509638475082729",
                "106915568864856288436707486586529388843",
                "160461748305160759432425790653772593920",
                "317668832181560233029467657143735579550",
                "73682667438275365798270958473607512942",
                "249449434883737352069413629640348278192",
                "195647711537184443325539778426838681880",
                "257419450339920369642547725144123517283",
                "112254453685341924447530792146304337784",
                "200506628299564351230936520852436132030",
                "99422724347327295676833174058837105043",
                "141225596712123407189091063186974358645",
                "281192752199487692721550185112564389005",
                "194840973750847596253923718843247966422",
                "336380174445271318603843347024206517237",
                "96952457555478317003593573357220284563",
                "288939005615045911177043736404399404541",
                "328674136467211459900128018005816102742",
                "75851200508167515578606821188405267014",
                "230110937255770512631639417010960709132",
                "243367955632336005134513142238333853843",
                "253728686788632627169401501763323725722",
                "28196279546092511104474535655606889983",
                "240985082911872732109250870253022523110",
                "7405899224190688798808783959628142002",
                "91368197618688457157980371544354479789",
                "158697872569671941832991527465912955348",
                "305106691200856417832257034142201370878",
                "289336218389088023408326258965270312936",
                "32131413311487982245812841291902270705",
                "133528045941229369766499737505022324454",
                "118600259359074066127455075675860467005",
                "277131013592039677111080227322086714878",
                "12132793595964136568255504321677124068",
                "237513637503532782536650314870439478037",
                "203609570456295320982548574336354293445",
                "51906176174227463930981612168786621659",
                "198425266314817376550601752740401743673",
                "239541424654697691920923576302018587810",
                "4477980581229884955895429889103133623",
                "65554406765763519915522339427629544886"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-46346-46a7ca97",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
        "target": {
            "file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "148290158881224018238036959085333174347",
                "132916980833278222585659789511700743125",
                "39081595628523478911170892959695322332",
                "174004738561766196974963097782734516062",
                "244203758964605445049890537553450586425",
                "6455052961807981930241870601080996339",
                "12522713305268573963244838950780597918",
                "299567008226308523412906777261965860758",
                "38303251870485956995300392521749761620",
                "253576719711034727620542678881631522082",
                "102099897323169189436255478382049411334",
                "248755282447788845428062614811896935669",
                "22824013103778680945337170153593721551",
                "90901951692397126058404997824004916719",
                "897602694625569215338623162217959429",
                "59303525747104975379831032757625057937"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-46346-66f2dd83",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef",
        "target": {
            "file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/UserBean.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "132283907619984408157237783707821521826",
            "length": 1437
        },
        "id": "CVE-2026-46346-795cab75",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef",
        "target": {
            "file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/UserBean.java",
            "function": "resetPasswordAction"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "104017446139140063737844681867739884294",
            "length": 1926
        },
        "id": "CVE-2026-46346-bb08964f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef",
        "target": {
            "file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/UserBean.java",
            "function": "sendPasswordResetLinkAction"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:01:09Z"